Admin User Deactivation & Security Manager
Deactivate Shopware 6 admin accounts without losing audit history. Middleware-level session blocking, forced password rotation, and full activity logging included.
The description shows what such a plugin can do. We tailor the scope to your shop after a short needs analysis and usually deliver within a few days.
In short
- Deactivate admin accounts instantly through the UI without touching the database
- Preserve full audit history and user activity logs when offboarding employees
- Block deactivated users at the middleware level — no workarounds, no backdoors
Why this extension
Without the plugin
Shopware 6 does not provide a built-in option to deactivate administrator accounts through the Admin UI — a significant security gap for businesses operating under PCI DSS requirements or any regulated environment. Manually editing the database offers no reliable solution: setting the active column has no effect on active sessions, and nullifying the password still allows the user to regain access via the "forgot password" function.
With the plugin
This plugin closes that gap entirely. It adds a proper deactivation workflow to the Shopware 6 administration panel, enforces session invalidation at the middleware level, and introduces mandatory password rotation policies — all without deleting user accounts or erasing audit history. It is part of our broader security extension suite for Shopware 6, designed to bring enterprise-grade access control to your e-commerce operations.
How it would work
- Deactivate a User
Navigate to Settings > Users & Permissions in the Shopware 6 Admin. Each user row now includes a Deactivate button. Clicking it sets the account to inactive and immediately invalidates any open sessions via middleware — the user cannot log back in, regardless of session state or password reset attempts.
- Configure Password Rotation Policy
In the plugin settings, define the maximum number of days before admin passwords must be changed. When the threshold is reached, the user is prompted to set a new password on next login. Policies can be applied globally or per user role.
- Review the Activity Log
Access the built-in activity log from the plugin dashboard. All administrative actions — including logins, failed login attempts, user deactivations, and settings changes — are recorded with timestamps and IP addresses, ready for export or audit review.
Frequently asked questions
Is this a ready plugin I can buy?
No – it is a concept. We build it for your shop after a short needs analysis. Prices start at €100 and you get a fixed quote before we start.
Will deactivating a user delete their order history or audit records?
No. Deactivation only prevents the user from logging in. All historical records, audit logs, and data associations remain fully intact. This is the core advantage over deletion-based workarounds.
Can a deactivated user regain access through the "forgot password" function?
No. The plugin enforces deactivation at the middleware level, meaning the system rejects authentication for inactive accounts before any password check occurs. The standard "forgot password" flow is also blocked for deactivated accounts.
Does this plugin help with PCI DSS compliance?
Yes. The password rotation enforcement feature directly addresses PCI DSS Requirement 8, which mandates periodic password changes and immediate access revocation for departed personnel. The activity log also supports audit trail requirements.
Is this plugin part of a larger security solution?
Yes. Admin User Control is one component of our security extension suite for Shopware 6. It integrates cleanly with our other security-focused plugins and can be deployed as a standalone solution or as part of a broader access management strategy.
Which Shopware versions are supported?
We build it for the version your shop runs: 6.5, 6.6 or 6.7. Updates for new Shopware versions are included as long as we stay in active contact.
How long does it take?
Usually 5–10 business days after the needs analysis, depending on the agreed scope.
All features
- One-click deactivation and reactivation of admin user accounts directly from Settings > Users & Permissions
- Middleware-level session blocking – deactivated users are immediately locked out, even with a valid session token
- Password rotation enforcement – configure mandatory password changes after a defined number of days (PCI DSS compliant)
- Admin activity log – records login events, configuration changes, and user management actions with timestamps and IP addresses
- Safe reactivation flow – administrators can re-enable accounts and trigger a forced password reset without data loss
- Full audit trail preservation – deactivating an account never deletes historical records or order associations
- Configurable notification system – alert administrators when accounts are deactivated or password policies are triggered
Ask about a custom build
Describe your shop and what you need. We will get back to you with questions and a fixed quote after a short needs analysis.
Specifications
- Shopware
- 6.5, 6.6, 6.7
- Type
- Made to measure
- Delivery
- 5–10 business days
- Updated
- 22 Oct 2026
Admin User Deactivation & Security Manager
from €100
Ask about a custom build